The risk involved with mixed content does depend on the type of website the user is visiting and how sensitive the data exposed to that site may be.

Malicious active content can steal the user's credentials, acquire sensitive data about the user, or attempt to install malware on the user's system (by leveraging vulnerabilities in the browser or its plugins, for example). The attacker can also rewrite the response to include malicious JavaScript code. In the mixed active content case, a man-in-the-middle attacker can intercept the request for the HTTP content. Hence, in addition to the risks described for mixed display content above, mixed active content is vulnerable to a few other attack vectors. This type of mixed content can alter the behavior of the HTTPS page and potentially steal sensitive data from the user. Mixed active content is content that has access to all or parts of the Document Object Model of the HTTPS page. subresources (when an performs HTTP requests).This section lists all types of HTTP requests which are considered passive content: If the attacker observes HTTP requests to certain images, they could determine which webpage the user is visiting. The attacker could also infer information about the user's activities by watching which images are served to the user often images are only served on a specific page within a website. For example, an attacker could replace an image served over HTTP with an inappropriate image or message to the user. Mixed passive/display content is content served over HTTP that is included in an HTTPS webpage, but that cannot alter other portions of the webpage. In the case of active content, the threat can lead to phishing, sensitive data disclosure, redirection to malicious sites, etc.

In the case of passive content, the threat is lower (the page may contain misleading content, or the user's cookies may be stolen). The difference lies in the threat level of the worst case scenario if content is rewritten as part of a man-in-the-middle attack. There are two categories for mixed content: mixed passive/display content and mixed active content. When a web page exhibits this behavior, it is called a mixed content page. If the HTTPS page includes content retrieved through regular, cleartext HTTP, then the connection is only partially encrypted the unencrypted content is accessible to sniffers and can be modified by man-in-the-middle attackers, so the connection is not safeguarded. When a user visits a page served over HTTPS, their connection with the web server is encrypted with TLS and is therefore safeguarded from most sniffers and man-in-the-middle attacks.

Sec7111 mixed content